Analysis
-
max time kernel
195s -
max time network
255s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
19-09-2024 22:38
General
-
Target
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe
-
Size
894KB
-
MD5
826eb90d730bf03e39d78daa585364bc
-
SHA1
d139eee9235e1f997ef14f014c7fbc3dd3b36a03
-
SHA256
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e
-
SHA512
c5e50071603a0f7f8e27098a7272f8fa9d987c6daba1104890afa354f1c2ba506c2476911e306d0bae99772159f2462b3f61e844b608b1e1ea0463df22a33d42
-
SSDEEP
24576:0NA3R5drX/WfwOauc1XayZWtTHOB8nDFQXi7hQHX:V5OfwOg1KyMHOi0i7hQ3
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
193.233.255.84:4284
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\2.exe"C:\Windows\Temp\2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
2KB
MD5c16d2e32f2426c34023fa61bb3bfb439
SHA1993bb6fd4a828ec1cfe15f8f0f29aca3d77e28e3
SHA256a1f451cd871df2272a8e39f0e13dfe427bccbcf2bed66b4d0498fa43849f54a9
SHA51290821f385a098e2d054569cebd42694e7ddc25c9d35d8d67acaa7f169bf2bf8652a225858666aa9a985a38a49b7ad7659cd6ddaafda12dabe885d5d35f2c0d0f
-
Filesize
2KB
MD55a9ee0498768cfcc5c61516fc5d780cd
SHA19ca59745b147d36da00237f6fed755738f5c759b
SHA256bde6e40a986984ed4dbfa69316c684b3ea2d5682ef6a66f34e9c0e0bfddfe3e5
SHA512275ee6966195d4ac0371a63de36e460936a706a1bbe80b815b6516eaa175227513a6158be0b72accddb3d1f303439d591e34776c3eda9b658d7e5fcbb5a9c6ed
-
Filesize
323KB
MD58214daede69a0da8327553bd9f8ae499
SHA1334655ca2474e04b411f064e86d4bbfd3b6b19f8
SHA2560d968172eebfc13e25d0e70b2d476e5711fc2e96604bbcfdfd89c0c157e7a61f
SHA512f8c8fa7344b5e9da9cbc835b71aac984ef6712b52101937074c0908e2bfc8fc01f875484ace40292c542bcb93196cac7267433e2cd5f4444878856b822101d3c
-
Filesize
435KB
MD51f3cfcf8aad3e5e3164405d272aa213e
SHA196f1c646d19deab4ff071fbc6b3c73c87ce56e49
SHA256fcdab9639af874cba780e20c21a9bc662b160dc313ddb75e5f82f779f1680101
SHA5120d2008b613bed0f1bed205ace8e89d13d5b5e0fca924ca1f9d0e322564c7d7610e0e735e3686701d3042fef1c164dcd43e40a67eb60199b885fbcb761fa41b06
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
448KB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
584KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
5.0MB
-
Filesize
424KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
456KB
-
Filesize
336KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
120KB
-
Filesize
1.0MB
-
Filesize
6.0MB
-
Filesize
40KB
-
Filesize
472KB
-
Filesize
300KB
-
Filesize
72KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
328KB
-
Filesize
5.2MB
-
Filesize
248KB